CVE-2026-0740

CVE-2026-0740 🧩 Overview CVE-2026-0740 is an unauthenticated arbitrary file upload vulnerability affecting: Ninja Forms File Uploads ≤ 3.3.26 WordPress plugin This flaw allows attackers to upload arbitrary files to the server without authentication, potentially leading to remote code execution RC...

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

WordPress Ninja Forms <3.4.34 - Open Redirect

WordPress Ninja Forms plugin before 3.4.34 contains an open redirect vulnerability via the wpajaxnfoauthconnect AJAX action, due to the use of a user-supplied redirect parameter and no protection in place. An attacker can redirect a user to a malicious site and possibly obtain sensitive...

Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting

The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin id: CVE-2024-7354 info: name: Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting...

WordPress Ninja Forms <3.3.18 - Cross-Site Scripting

WordPress Ninja Forms plugin before 3.3.18 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in includes/Admin/Menus/Submissions.php via the begindate, enddate, or formid parameters. This can allow an attacker to steal cookie-based authentication credentials a...

CVE-2019-10869

CVE-2019-10869 Wordpress Ninja Forms File Uploads Extension -----------------------------16345274557837-- Response: HTTP/1.1 200 OK Server: nginx/1.14.0 "data": "files": "name":"test.png.doc", "type":"application/msword", "tmpname":"nftmp-14FpD-test.png.doc", "erro...

ninja-forms-brute

Ninja Forms 3.6.8 - Unauthenticated Email Address Disclosure Description The plugin does not delete the temporary files created when exporting submissions, which could allow unauthenticated attackers to download them and get sensitive information such as the email address of users who submitted a...

CVE-2023-37979

CVE-2023-37979 Unauth. Reflected Cross-Site Scripting XSS vulnerability in Saturday Drive Ninja Forms Contact Form plugin = 3.6.25 versions. PoC and Checker , for educational purposes only 'python3 exploit.py https://target.com'...

ninja-form-exploit

ninja-form-exploit CVE-2026-0740 — Multi-threaded vulnerability scanner for the Ninja Forms File Upload path traversal issue on WordPress. Description main.py scans a list of WordPress targets to determine whether the Ninja Forms File Uploads plugin is vulnerable to CVE-2026-0740. Brief flow: 1...

CVE-2026-0740-mass

CVE-2026-0740 — Mass-Target Exploit Engine Author: 0xNuts Contributor: Cursor Repository: https://github.com/ExDev994/CVE-2026-0740-mass PoC for CVE-2026-0740: Ninja Forms File Uploads = 3.3.26 — Unauthenticated Arbitrary File Upload which can lead to RCE. Original vulnerability discovered by Sél...

CVE-2026-126537

The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion and arbitrary file read via S3/Dropbox/Google Drive exfiltration in versions up to, and including, 3.3.36. The flaw spans NFFUFieldsUpload::process in includes/fields/upload.php — which returns early...

EUVD-2026-123410

The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion and arbitrary file read via S3/Dropbox/Google Drive exfiltration in versions up to, and including, 3.3.36. The flaw spans NFFUFieldsUpload::process in includes/fields/upload.php — which returns early...

CVE-2026-126537

The Ninja Forms - File Uploads add-on for WordPress (versions up to and including 3.3.36 ) is vulnerable to Arbitrary File Deletion . The flaw exists in NF_FU_Fields_Upload::process() and NF_FU_External_Abstracts_Service::process_upload(). When a public submission includes a non-empty extra.saveP...

CVE-2026-126537 Ninja Forms - File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'

The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion and arbitrary file read via S3/Dropbox/Google Drive exfiltration in versions up to, and including, 3.3.36. The flaw spans NFFUFieldsUpload::process in includes/fields/upload.php — which returns early...

CVE-2026-0740

CVE-2026-0740 Ninja Forms File Uploads = 3.3.26 - Unauthenticated Arbitrary File Upload to RCE Exploit for CVE-2026-0740 discovered by Selim Lanouar whattheslime. For a complete technical deep dive, read the full article on Lexfo's blog. Disclaimer This repository is provided for research and...

WordPress Ninja Forms - File Uploads plugin <= 3.3.36 - Unauthenticated Arbitrary File Deletion vulnerability

WordPress Ninja Forms - File Uploads plugin = 3.3.36 - Unauthenticated Arbitrary File Deletion vulnerability discovered by daroo in WordPress Plugin Ninja Forms File Uploads Extension versions = 3.3.36...

VulnCheck KEV: CVE-2026-126537

The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion and arbitrary file read via S3/Dropbox/Google Drive exfiltration in versions up to, and including, 3.3.36. The flaw spans NFFUFieldsUpload::process in includes/fields/upload.php — which returns early...

PT-2026-145209

Name of the Vulnerable Software and Affected Versions Ninja Forms - File Uploads versions prior to 3.3.37 Description The Ninja Forms - File Uploads add-on for WordPress allows unauthenticated attackers to delete arbitrary files on the server or perform arbitrary file reads via exfiltration to S3...

CVE-2026-126537: SaturdayDrive Ninja Forms - File Uploads: The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read…

The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion and arbitrary file read via S3/Dropbox/Google Drive exfiltration in versions up to, and including, 3.3.36. The flaw spans NFFUFieldsUpload::process in includes/fields/upload.php — which returns early...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Unauthenticated Arbitrary File Upload. Description : The Ninja Forms - File Uploads plugin for WordPress is vulnerable to unauthenticated arbitrary file upload due to missing file type validation and missing capability checks in the...